panic: kern/52718

[Terry Lambert]

David Xu wrote:
> > This was caused by rev. 1.3 of a commit by Jeff Robertson to
> > kern_utmx.c.  The problem is that the proc struct is not locked
> > for:
> >
> >         FOREACH_THREAD_IN_PROC(td->td_proc, td0)
> >
> > in the lock and unlock.
> >
> > Either lock the proc before and unlock it after this, in both
> > _utmx_lock() and _utmx_unlock(), or revert the code to 1.2.
> 
> kern_sig.c has same issue in several places.

Just looked... YUCK!  The Process group code and the code in
the filt_sigdetach() have got to be what you are talking about,
right?

I'm constantly surprised at some of the race windows I find in
production code (not just FreeBSD), that are just waiting there
to chew someone's leg off the first chance they get... 8-(.

-- Terry